Webhooks

{
  "event": "person.created",
  "workspace_slug": "workspace-do-cliente",
  "timestamp": "2026-05-26T14:00:00Z",
  "data": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "full_name": "Ana Costa",
    "emails": [{ "email": "ana@empresa.com", "reminder": "work" }],
    "created_at": "2026-05-26T14:00:00Z"
  }
}

X-Vendaze-Signature: sha256=abc123...
X-Vendaze-Timestamp: 1748000000

const crypto = require('crypto');

function isValidSignature(body, timestamp, receivedSignature, secret) {
  // Rejeitar payloads com mais de 5 minutos
  const now = Math.floor(Date.now() / 1000);
  if (now - parseInt(timestamp) > 300) return false;

  const message = `${timestamp}.${JSON.stringify(body)}`;
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(message).digest('hex');

  return crypto.timingSafeEqual(Buffer.from(receivedSignature), Buffer.from(expected));
}